AaronFiore/electrum
1
0
Fork 0
Code Activity

build: don't allow setuptools to sneakily install build-time deps

Browse Source 
see https://pip.pypa.io/en/stable/reference/pip_install/#controlling-setup-requires
> Setuptools offers the setup_requires setup() keyword for specifying
> dependencies that need to be present in order for the setup.py
> script to run. Internally, Setuptools uses easy_install to
> fulfill these dependencies.
> pip has no way to control how these dependencies are located.
> None of the package index options have an effect.

With these changes, we will now instead hard fail if this were to happen.

related: https://github.com/spesmilo/electrum/issues/5859#issuecomment-743621898
This commit is contained in:
SomberNight
2020-12-12 02:52:38 +01:00
parent a83805e00b
commit 19f806ddf4
6 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
contrib/build_tools_util.sh
View File

@@ -129,3 +129,25 @@ fi
export GCC_STRIP_BINARIES="${GCC_STRIP_BINARIES:-0}"
function break_legacy_easy_install() {
# We don't want setuptools sneakily installing dependencies, invisible to pip.
# This ensures that if setuptools calls distutils which then calls easy_install,
# easy_install will not download packages over the network.
# see https://pip.pypa.io/en/stable/reference/pip_install/#controlling-setup-requires
# see https://github.com/pypa/setuptools/issues/1916#issuecomment-743350566
info "Intentionally breaking legacy easy_install."
DISTUTILS_CFG="${HOME}/.pydistutils.cfg"
DISTUTILS_CFG_BAK="${HOME}/.pydistutils.cfg.orig"
# If we are not inside docker, we might be overwriting a config file on the user's system...
if [ -e "$DISTUTILS_CFG" ] && [ ! -e "$DISTUTILS_CFG_BAK" ]; then
warn "Overwriting python distutils config file at '$DISTUTILS_CFG'. A copy will be saved at '$DISTUTILS_CFG_BAK'."
mv "$DISTUTILS_CFG" "$DISTUTILS_CFG_BAK"
fi
cat <<EOF > "$DISTUTILS_CFG"
[easy_install]
index_url = ''
find_links = ''
EOF
}